If its happen that you like to run your honeypot on a Windows system then Honeyport is something worth to try.
Honeyports is a powershell script that will Creates a job that listens on TCP Ports specified and when a connection is established, it can either simply log or add a local firewall rule to block the host from further connections.
The script is written by John Hoyt, Carlos Perez and Greg Foss and it’s available on https://github.com/Pwdrkeg/honeyport/
Once you download the script you need to run it with an administrator privileges ,in this example I am going to configure it to listen on port 2222
One of the greatest features of the honeyports powershell script that it will log to the Windows events ,the events would be logged under the name of honeyports
Now let’s try to connect to port 2222 and see what’s will happen :
From another machine I will netcat to port 2222
And I will run the following powershell command
Now let’s explore one more thing , honeyports can block the IP address that established a connection to the specified port by adding a new rule to the Windows Firewall.
And when we check the eventlog
The script will block only the tcp protocol from that IP address. If you would like to block all the traffic you need to do a small modification to the script.
On line 133 you have to change
And after your done with the honeyports you should stop the job by running
And don’t forget to unblock the IP addresses that have been blocked by the script by running
Apr 22nd 2016
1 year ago